Block Mail with 2 sender in the to of the mail

[rockbd]

Hi

Recently am getting some mail which contain 2 mail id in the to of the mail header. One is a valid mail other is unknown (the spam/malware) mail. How can i block this type of spam/malware. Also it contain html link(web link which download some malware) this message how to block the link if the message pass through the Ironport.

I wish i made clear my problem as my english is not poor.

[dmccabej]

Hello,

There are a few different ways to block a sender using the envelope-sender address. Two possibilities would be to create a new mail policy for that specific sender and then set up a content filter on that mail policy to drop, or to setup a content filter that includes that sender as a condition and then set the action to drop. As always, you'll also want to make sure you're using any security engines available to scan the email. (Eg: Anti-Spam / Anti-Virus / AMP / URL Filtering / VOF / Etc)

The user guide has step-by-step details on setting up a filter using the envelope sender condition :

https://www.cisco.com/c/en/us/td/docs/security/esa/esa11-1/user_guide/b_ESA_Admin_Guide_11_1/b_ESA_Admin_Guide_chapter_01010.html#con_1127271 

Thanks!

-Dennis M.